Your Mac's git and curl still trust the eMudhra certificates: a 5-minute check

After eight eMudhra intermediate CA keys were compromised in October 2026, Apple moved to distrust them, and Safari and other apps that use the system keychain are protected. It is easy to assume a Mac is therefore fine. But the command-line tools developers rely on every day — git, curl, python3, openssl — often do not use the system keychain at all. They carry their own list of trusted certificate authorities, and a macOS update does not touch it.

So on the same machine, Safari can reject a compromised certificate while curl or a Python script accepts it, because they are reading a different trust store. This is a short, Mac-specific companion to the main eMudhra guide — how to see which store each tool uses and bring them all up to date.

Updating servers and containers too? The main eMudhra guide for servers →

Why your Mac still trusts them

macOS has more than one trust store. The system keychain is what Security.framework uses, so Safari and apps built on it follow Apple's distrust decision automatically. But many developer tools are built against OpenSSL or ship their own roots, and those read a file-based CA bundle instead — commonly /etc/ssl/cert.pem, a Homebrew ca-certificates file, or Python's certifi. Updating macOS does not rewrite those files, so a compromised intermediate stays trusted there until you update the bundle that owns it.

Which tools are affected

Check in two minutes

Find out which store each tool reads, then look for eMudhra in it. If the name appears in a bundle a tool uses, that tool still trusts the compromised chain.

# 1. Where does OpenSSL look for its trusted roots?
openssl version -d
# usually: OPENSSLDIR: "/opt/homebrew/etc/openssl@3" (Homebrew) or "/etc/ssl"

# 2. Is eMudhra still in the bundles your CLI tools use?
grep -rl -i emudhra /etc/ssl/cert.pem /opt/homebrew/etc/ca-certificates 2>/dev/null
python3 -c "import certifi,subprocess; print(certifi.where())"   # then grep that file
# 3. Which TLS backend does your curl use? (Secure Transport = system; others = own bundle)
curl -V | head -1

Update the bundles

1. 1
   Update the Homebrew CA bundle. ca-certificates is the file most OpenSSL-linked tools (including Homebrew curl and git) read, and openssl@3 pulls it in.
2. 2
   Update certifi in every Python environment. certifi is per-virtualenv, so a global update does not fix a project venv — upgrade it inside each one that makes HTTPS calls.
3. 3
   Upgrade Node.js. Node bundles its own roots, so the fix ships with the runtime; the October releases drop the compromised eMudhra intermediates (see the main guide).
4. 4
   Re-run the checks until eMudhra no longer appears in any bundle your tools use.

# Homebrew: refresh the CA bundle that curl/openssl/git use
brew update && brew upgrade ca-certificates openssl@3

# Python: update certifi in each environment that makes HTTPS calls
python3 -m pip install --upgrade certifi      # per venv

# Node.js: the bundled roots ship with the runtime — update Node itself
# (the October releases drop the compromised eMudhra intermediates)
node -v   # then upgrade to a patched 22/24/26 line

Common questions

Want every tool and server checked for you?

I can audit the trust stores across your Macs, servers and container images, update the right bundles, and verify nothing still trusts the compromised chain. See security patching. Related: the main eMudhra guide for servers and October 2026 security roundup.